nasa-gcn vulnerabilities and threats

CVE-2026-123664 is an improper authorization vulnerability in the Email Notification Handler component of nasa-gcn's gcn.nasa.gov system. The flaw involves manipulation of the Recipient argument in the /user/email processing, allowing unauthorized actions remotely. The issue affects versions up to commit b299b562af665878964b981a459f0a9c04b11adf. A fix has been developed but is pending acceptance in a pull request. Exploit code has been publicly released, increasing the risk of exploitation. The product uses a rolling release model, so specific affected versions are not defined.